What Is Drive-by Download?

A drive-by download installs malware through a web page without the visitor deliberately downloading anything. Visiting the page is sufficient, because the page exploits a vulnerability in the browser or a component it uses.

It is the delivery mechanism behind watering hole attacks and behind malicious advertising, and it requires no user error beyond visiting a page.

How the delivery works

Malicious content is placed on a page, either because the site was compromised or because it arrived through an advertising network. Script fingerprints the visitor's browser, plugin and operating system versions.

A matching exploit is served, code executes in the browser's context, and a payload is retrieved and installed. The entire sequence completes in under a second and displays nothing.

Malicious advertising reaches legitimate sites

Advertising is served by networks rather than by the site, which means a reputable publisher can deliver a malicious advertisement without being compromised at all.

That breaks reputation-based defence entirely: the domain the user visited is genuinely trustworthy. It is also the strongest practical argument for content blocking in the browser, which removes a large share of this route.

Why it has declined and not disappeared

Browsers now update automatically, run content in sandboxes and have dropped the plugin architectures that supplied most historic exploits. Exploit kits are correspondingly less productive than they were.

What remains: unpatched browsers on unmanaged or legacy systems, genuinely new browser vulnerabilities, and the socially engineered variant — a page that convinces the user to run something themselves, which needs no exploit at all.

The fake update pattern

The most common current variant does not exploit anything. A page displays a convincing prompt — a browser update, a missing font, a required plugin, a verification step asking the user to paste a command — and the user installs the malware themselves.

Technically this is social engineering rather than a drive-by, and operationally it arrives through the same channel and needs the same detection. Application control, which prevents unapproved executables running, is the control that addresses it.

Detection is behavioural

A browser process spawning a scripting engine or a command shell. A new executable written to a user profile directory shortly after web activity. A new persistence entry. An outbound connection to infrastructure with no history.

Because the visited site may be entirely legitimate, network reputation gives no warning, and endpoint behavioural detection carries the load.

Poisoned search results deliver the same payload

Rather than waiting for visitors to a compromised site, attackers buy search advertising or optimise pages for common software download queries. The user searches for a legitimate tool, clicks the top result and installs a modified installer.

It is effective because the user is actively looking for software and intends to run it. The defences are application control, installation from known vendor addresses or an internal software catalogue, and blocking search advertising — which removes the most reliable version of this route.

Where to start

Verify that browsers update automatically everywhere, including on servers and on systems outside your main management tooling. Those exceptions are where this attack still lands.

See endpoint security. GuardsArm delivers managed detection and response.